Provenance

The default OpenClaw memory backend keeps Markdown artifacts plus a SQLite index and metadata (memory architecture). Each indexed chunk carries an origin class (owner, agent, untrusted, system) stored outside the prose. Recalled text therefore cannot promote its own trust level, and classification never defaults to owner. Graph memory layers like Zep's Graphiti also trace facts to their sources. What OpenClaw adds is a gate that consumes the provenance. The dreaming consolidation pass drops untrusted and system candidates before the consolidation prompt is even built. Automatic session ingestion excludes cron, heartbeat, and subagent sessions. These exclusions do not prevent direct file writes by tools with the required access. Taint follows content within a turn, too. After a network-sourced tool result, every later assistant message in that turn is marked tainted and classifies untrusted for memory, whoever was speaking. Cross-conversation recall has a fixed boundary: groups and channels are neither source nor destination (active memory).

Related research provides context, not validation of OpenClaw's implementation. Generative Agents explores relevance, recency, and importance in retrieval. MMR balances relevance and diversity. Sleep-time compute studies useful precomputation before a query. LongMemEval shows that retained detail, indexing, retrieval, and reading strategy all affect long-term recall. Memory-poisoning work such as MINJA and OWASP ASI06 motivates careful trust boundaries. Provenance-gated promotion does not establish immunity to every poisoning attack. TriggerBench studies prospective memory, a problem OpenClaw also addresses with explicit standing intents.

Deletion needs a separate distinction. Ghost Vectors examines recovery from soft-deleted vector storage. Forgotten-session records prevent reingestion through participating OpenClaw paths. They do not establish physical or cryptographic erasure of underlying storage.

Entries tracked by automatic session ingestion and backfill keep their origin sessions through consolidation. Origins union on merge and re-key on supersede, and the model never carries provenance itself. An admission policy keeps designated sessions out of dreaming ingestion and session backfill with recorded, reversible exclusions. openclaw memory forget purges attributable entries, exact diary quotations, index rows, vectors, embedding caches, and rewrite backups. It then blocks reingestion of the selected sessions with durable forgotten-session records. A participant selector selects whole sessions involving that participant, not only their messages. Direct edits, untracked memories and paraphrases, original transcripts, other agents' stores, exports, and external copies require separate review. Neither admission nor forgetting is a general erasure guarantee (deletion boundaries).

Forgotten-session records protect a specific boundary: OpenClaw's participating ingestion, backfill, and indexing paths do not restore data from those session IDs in that agent's store. They do not prevent a later conversation, direct file write, or another memory plugin from introducing the same information. Provenance and deletion should be evaluated against those documented boundaries, not treated as proof of universal non-resurrection or regulatory compliance.

The audit ledger stores identity, ordering, action, and outcome codes. It never stores prompts, bodies, arguments, or filenames. Queries enforce a 30-day retention cutoff with row caps, and physical pruning is batched. Decision receipts use a closed vocabulary where enforced marks decisions from a gate that actually governed the action. A bare success is never upgraded into authorization proof. The docs publish their own non-claims, including "absence of a row proves nothing" and pseudonymization being correlation rather than anonymization. OpenTelemetry can export operational diagnostics to your SIEM, but bounded queues, sampling, shutdown, and exporter failures can lose data. Neither surface promises a lossless compliance archive.

Participating channel ingress queues retain events that exhaust their retry policy in an inspectable, resubmittable dead-letter queue. This does not cover every inbound path: IMAP triggers dispatch through a separate hook path without channel dead-letter resubmission. Outbound messages carry staged terminal states. The design goal is a visible outcome or a recorded, intentional non-outcome for every action. The audit coverage and loss limits above still apply.

Independent verification exists at three levels. There is a community threat model mapped to MITRE ATLAS. There are TLA+ models of the riskiest authorization and isolation paths. Those are models of the design, checked in bounded state spaces, and they do not establish that "the TypeScript is verified", as the docs state. There is also a public maturity scorecard that grades our coverage.